Skills & Agents

Test process + methodology: 19 skills + 7 agents covering risk-based testing, DoD, test strategy, blameless post-mortems, release readiness, smoke gating, pyramid analysis, TDD coaching, E2E budgets.

QA people-and-org toolkit for QA managers and heads of quality: 5 skills (career-ladder-author, exec-quality-narrative, performance-feedback-author, skill-matrix-author, tester-one-on-one-planner) and 1 agent (team-capability-gap-analyst). Covers team capability mapping per ISTQB CTAL-TM v3.0 Managing the Team, IC/management career ladders, GROW-model 1:1s, SBI evidence-based feedback, and Minto-pyramid executive quality narratives.

Test data engineering: 17 skills (bogus-data, boundary-value-generator, e2e-test-narrative-builder, factory-bot-data, faker-data, golden-file-conventions, malicious-payload-bank, mimesis-data, mountebank-imposters, msw-handlers, negative-test-generator, pairwise-test-case-generator, seed-data-curator, synthetic-data-tool-selector, synthetic-pii-generator, test-data-patterns, wiremock-stubs) and 3 agents (golden-file-manager, mock-server-composer, test-data-setup-agent).

Test environment management: 4 skills (docker-compose-tests, feature-flag-test-harness, playwright-fixture-builder, testcontainers) and 2 agents (db-snapshot-restore, test-environment-bootstrapper). Composes with parallel-isolation-checker in qa-flake-triage for shared-state diagnosis.

Test impact analysis + regression-suite hygiene: 2 skills (regression-suite-selector, coverage-debt-tracker) and 2 agents (test-suite-pruner, regression-suite-curator).

Test case management discipline (pre-execution authoring + lifecycle + traceability): 1 reference skill (test-case-anatomy-reference) + 5 platform case-management skills (testrail-case-management, xray-case-management, zephyr-scale-case-management, allure-testops-case-management, qase-io-case-management) + 1 build skill (traceability-matrix-builder) + 2 agents (test-case-quality-critic, tcm-migration-agent). Distinct from qa-test-reporting's *-integration skills (post-execution result sync); this is pre-execution case authoring + repository management.

Test reporting + coverage analytics: 15 skills - parsers (junit-xml-analysis, lcov-analysis, cobertura-analysis, allure-reports), build-an-X reporters (coverage-diff-reporter, test-run-summary-author), commercial integrations (extentreports, currents-integration, testrail-integration, xray-integration, zephyr-integration), per-language coverage analyzers (jest-coverage-analysis, jacoco-analysis, coverage-py-analysis), and test-coverage-targeter - plus 2 agents (daily-test-suite-aggregator, release-quality-report-agent).

Test code reviewers for test files only — production code is out of scope. 5 skills (object-model-patterns, test-code-conventions, test-framework-blueprint, test-isolation-patterns, test-step-design-patterns) and 6 agents (assertion-quality-reviewer, e2e-selector-quality-critic, framework-architecture-auditor, mocking-anti-pattern-detector, test-code-critic, test-suite-health-auditor).

API testing: 8 skills (api-chaos-runner, api-testing-getting-started, karate-testing, postman-collections, restassured-testing, restler-fuzzing, schemathesis-fuzzing, tavern-testing) and 2 agents (api-test-author, api-test-tool-selector).

BDD pipelines: 10 skills (acceptance-test-from-criteria, bdd-getting-started, bdd-step-library-curator, behave-testing, cucumber-testing, gherkin-from-stories, living-documentation-publisher, manual-step-to-gherkin, reqnroll-testing, specflow-testing) and 2 agents (bdd-scenario-author, gherkin-style-reviewer).

Contract testing for microservices: 5 skills (contract-compatibility-gate, graphql-schema-regression, openapi-contract-diff, pact-contract-testing, protobuf-compat-checking) and 2 agents (contract-drift-investigator, contract-test-scaffolder).

Desktop application testing across Windows (WinAppDriver, Appium-Windows), macOS (XCTest UI, Apple Accessibility Inspector), Linux (AT-SPI), Electron (Playwright _electron API), and Qt (QtTest framework)

Embedded C/C++ testing: GoogleTest on ARM, ThrowTheSwitch Unity-C and Ceedling, gcov coverage, QEMU system emulation

Game engine testing (Unity, Unreal, Godot), platform certification overview (Sony TRC, Nintendo Lotcheck, MS XR, Steam Direct), multiplayer state machine coverage, and gameplay recording/replay

Mobile + mobile-web E2E testing: 11 skills covering xcuitest-suite, espresso-suite, appium-testing, detox-testing, maestro-flows, flutter-testing, mobile-device-matrix-toolkit, mobile-web-emulation-runner, touch-gesture-tester, mobile-web-perf-budget, mobile-a11y-test-author - plus 3 agents (mobile-driver-selector, mobile-test-author, mobile-test-scaffolder).

Mutation testing across languages: 5 skills (mull-mutation, mutmut-mutation, pitest-mutation, stryker-mutation, stryker-net-mutation) and 2 agents (mutation-survivor-explainer, mutation-tool-selector).

Property-based testing libraries: 5 skills covering Hypothesis (Python), fast-check (JS/TS), proptest (Rust), jqwik (JVM), and QuickCheck (Haskell) + ScalaCheck - each ships authoring + run + shrinking + CI integration - plus 3 agents (property-based-test-author, property-based-tool-selector, vacuous-property-critic).

Go + Rust unit testing per-framework wrappers: 5 skills (cargo-test, ginkgo-tests, go-rust-mocking, go-test, rstest-tests) and 2 agents (go-rust-framework-selector, go-rust-test-author).

JS/TS unit testing per-framework wrappers: 5 skills (ava-tests, jasmine-tests, jest-tests, mocha-tests, vitest-tests) and 1 agent (js-test-author). Per-framework lifecycle (configure / run / mock / coverage / CI). Does not duplicate qa-test-review test code hygiene.

JVM unit testing per-framework wrappers: 6 skills (assertj, junit5-tests, kotest-tests, scalatest, spock-tests, testng-tests) and 2 agents (jvm-framework-selector, jvm-test-author).

.NET unit testing per-framework wrappers: 4 skills (fluentassertions, mstest-tests, nunit-tests, xunit-tests) and 2 agents (dotnet-test-author, dotnet-test-framework-selector).

Python unit testing per-framework wrappers: 5 skills (doctest-tests, nose2-tests, pytest-asyncio-patterns, pytest-tests, unittest-tests) and 1 agent (python-test-author).

Web E2E framework wrappers + cross-browser strategy and grids: 8 skills (playwright-testing carrying the cross-browser matrix reference, cypress-testing, selenium-testing, webdriverio-testing, cloud-grid-e2e covering BrowserStack / Sauce Labs / LambdaTest, selenium-grid-4-runner for the self-hosted grid, browser-matrix-strategy-reference with the T1/T2/T3 tiering + compatibility budget + matrix review checklist, and the web-e2e-overview decision guide) and 2 agents (playwright-codegen-reviewer, which also reviews Cypress Studio recordings, and automation-harness-bootstrapper, which scaffolds a full E2E harness skeleton for a repo with no suite).

Atomic accessibility coverage: 13 skills (a11y-violation-gate, aria-authoring-patterns, axe-a11y, ibm-equal-access-a11y, lighthouse-a11y, pa11y-a11y, screen-reader-test-author, wave-a11y, wcag-checklist-builder, wcag-color-contrast, wcag-focus-trap, wcag-keyboard-navigation, wcag-compliance-reporter) and 2 agents (accessibility-code-critic, screen-reader-test-executor).

Firefox + Chrome extension testing: 3 skills (playwright-extension-fixtures with the reload matrix + chrome.storage quota tests, chrome-extension-messaging-tests, manifest-v3-test-surface-reference with the web-ext Firefox CLI) and 1 agent (extension-test-author, which composes them to author one Playwright spec per behavior spec).

Data quality testing for analytical pipelines: 5 skills (dbt-testing, great-expectations, soda-checks, data-quality-gate, data-quality-conventions) and 2 agents (schema-diff-reviewer, data-anomaly-triager).

Localization (l10n) + i18n testing: 4 skills (i18n-string-coverage, locale-format-validator, pseudo-localization-runner, rtl-rendering-tester) and 1 agent (l10n-audit-runner).

PDF + print rendering tests: 4 skills (html-to-pdf-regression, pdf-accessibility-checker, pdf-snapshot-tester, print-stylesheet-tests) and 1 agent (pdf-test-author). Covers print/PDF output where qa-visual-regression covers screen output.

PWA testing: 5 skills (workbox-tests carrying the cache-strategy design reference, web-push-tests, service-worker-lifecycle-tests carrying the general Playwright SW harness, offline-fallback-tests, add-to-homescreen-flow-tests carrying the install-flow reference contract) and 1 agent (pwa-test-author, one Playwright spec per PWA surface) - the single home for service-worker, install-flow, and cache-strategy testing, distinct from qa-notifications' cross-channel push harness

Visual regression testing: 7 skills (percy-visual-regression-testing, chromatic-visual-regression-testing, playwright-snapshots with the responsive breakpoint matrix, storybook-visual-regression-testing, chart-render-tests covering Chart.js / D3 / Vega chart regression, visual-baseline-conventions, visual-baseline-gate emitting binding gate artifacts) and 2 agents (visual-diff-classifier with a per-PR summary mode, visual-baseline-curator).

Compliance test patterns + readiness review: 8 skills (audit-trail-test-author, ccpa-test-patterns, compliance-evidence-generator, gdpr-test-patterns, hipaa-test-patterns, iso27001-test-patterns, pci-dss-control-test-author, soc2-evidence-collector) and 1 agent (compliance-readiness-reviewer). Covers regulated-industry test pattern catalogs.

Structure-aware coverage-guided fuzzing: 3 reference skills (corpus-management-reference, sanitiser-integration-reference, crash-triage-reference) + 7 per-language fuzzer skills (libfuzzer-cpp, afl-plus-plus, go-native-fuzzing, cargo-fuzz-rust, atheris-python-fuzzing, jazzer-jvm-fuzzing, ossfuzz-integration) + 1 dispatcher skill (fuzz-tool-selector) + 2 agents (fuzz-target-author, fuzz-findings-critic). Distinct from qa-property-based (hypothesis-driven + shrinking) and qa-api-testing/schemathesis-fuzzing (API-layer); this is binary/system-level coverage-guided fuzzing.

Infrastructure-as-code testing + security policy: 4 skills (helm-chart-tester, policy-as-code-runner, checkov-policy, trivy-config - the tfsec successor, with the legacy tfsec workflow in its references) and 1 agent (terraform-plan-reviewer). Cross-scanner IaC finding triage is handled by security-finding-triager in the qa-security-scanning plugin.

Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.

Unified security scanning across five domains - SAST (semgrep-rules, sonarqube-rules, codeql-queries, language-native-sast, multi-tool-finding-triage), DAST (zap-baseline, nuclei-dast), SCA (snyk-test, osv-scanner, dependabot-config, renovate-config, npm-pip-maven-audit, reachability-analyzer, cve-exploitability-triage), secrets (gitleaks-scanning, trufflehog-scanning, secrets-rotation-runner), and SBOM + container (syft-generation, sbom-formats, trivy-image, vex-author): 21 skills and 1 agent (security-finding-triager), the cross-domain adversarial unifier that gates multi-scanner output into one BLOCK / PASS verdict per domain. Every scanner skill includes a mandatory False-positive triage section.

PII detection, masking, and synthetic data generation for test environments: 8 skills (data-masking-techniques-reference, faker-synthetic-data, k-anonymity-verifier, pii-categories-reference, pii-masking-pipeline-builder, presidio-pii-detection, synthea-healthcare-data, test-data-governance-reference) and 1 agent (pii-leak-critic).

Bug reproduction workflow: 1 skill (bug-report-template) and 9 agents (bug-report-from-recording, bug-repro-builder, crash-stack-trace-analyzer, defect-clusterer, defect-pipeline-runner, defect-trend-narrator, escape-defect-analyzer, failure-classifier, test-failure-debugger).

Defect management discipline (taxonomy, lifecycle, workflows): 3 reference skills (bug-lifecycle-reference, severity-vs-priority-reference, defect-taxonomy-istqb) + 4 platform-workflow skills (jira-bug-workflow-runner, linear-bug-workflow-runner, github-issues-bug-workflow, azuredevops-bug-workflow) + 1 build skill (bug-report-from-failure) + 4 agents (duplicate-defect-finder, bug-report-critic, ci-defect-filer, defect-fix-verifier). Distinct from qa-bug-repro which covers reproduction + clustering + trend narration; this covers triage workflow + taxonomy + severity classification, and closes the lifecycle with post-fix confirmation testing.

Flake triage: 4 skills (flake-dashboard-author, flake-pattern-reference, flake-remediation-guide, flaky-test-quarantine) and 5 agents (ai-flake-detector, e2e-flake-bisector, e2e-test-trend-reporter, parallel-isolation-checker, regression-bisector).

Load and performance testing: 9 skills (load-testing-overview - tool selection, load profiles, incident triage, Gatling/Locust references; k6-load-testing with latency-percentile interpretation; jmeter-load-testing; lighthouse-perf with budget authoring; web-vitals-inp-deep for per-interaction INP budgets; perf-budget-gate; flame-graph-analyzer; db-query-plan-analyzer; slo-load-test-plan).

Chaos engineering, fault injection, and resilience drills: 7 skills (chaos-experiment-author, chaos-mesh, toxiproxy-chaos, failure-injection-test-author, chaos-drill-protocol, dr-drill-runner, error-budget-tests). Chaos-experiment design with steady-state pre-flight validation and LitmusChaos/Gremlin routing, the chaos-drill run protocol with abort gates, Chaos Mesh, Toxiproxy, and combined HTTP+TCP fault injection, plus the DR-drill discipline (backup verification + restore-time / RTO measurement in references) and error-budget gating with burn-rate alerting and incident metrics.

Shift-left QA: 4 skills (acceptance-criteria-extractor, gherkin-scenario-coverage-map, data-contract-extractor, nfr-extractor) and 4 agents (definition-of-done-checker, spec-to-suite-orchestrator, testability-reviewer, threat-model-from-spec).

Production-side QA per ISTQB-canonical shift right ("a test approach to test a system continuously in production"): 4 skills (feature-flag-experiment-validator, prod-canary-validator, rum-to-synthetic-gap-analyzer, synthetic-monitor-author) and 2 agents (canary-and-experiment-coordinator, observability-to-test).

Background job and queue testing: 8 skills (bullmq-tests, celery-tests, cron-job-test-author, idempotency-test-author, kafka-consumer-tests, rabbitmq-tests, sidekiq-tests, sqs-tests) and 1 agent (async-job-health-critic). Covers async job runners, queue patterns, scheduled jobs, and idempotency guarantees.

Cache testing across layers: Redis cache patterns, CDN cache-purge testing (Cloudflare, Fastly, CloudFront), Varnish VTC syntax, browser Cache-Control tests, cache-coherence + stampede + stale-while-revalidate references, and a cache-key collision detector. Covers RFC 9111 HTTP caching and the canonical multi-tier cache discipline (browser to CDN to app to data store).

Concurrency + race-condition testing: 6 skills (async-ordering-tests, deadlock-detection-harness, go-race-detector-workflow, jepsen-patterns, mvcc-isolation-tests, race-condition-test-author) and 1 agent (concurrency-critic). Code-level data races, distinct from qa-resilience (infrastructure fault injection).

Database migration testing: 4 skills (atlas-migrations, flyway-migrations, liquibase-migrations, sqlmesh-migrations) and 2 agents (db-migration-performance-critic, migration-blast-radius-reviewer). Covers schema-change safety, blast-radius review, and rollback verification across the major migration tools.

Distributed tracing assertion testing: 6 skills (jaeger-trace-tests, opentelemetry-trace-assertions, otel-collector-config-tester, tempo-trace-tests, trace-spec-author, zipkin-trace-tests) and 1 agent (trace-coverage-reviewer). Asserts on production trace shape (spans, attributes, parent links, status), not just on aggregate metrics.

Saga + CQRS + event sourcing test patterns: 5 skills (cqrs-projection-tests, event-sourcing-tests, eventual-consistency-tests, outbox-pattern-test-author, saga-transaction-tests) and 1 agent (saga-critic). Covers ACD-without-isolation saga tests, replay determinism, and projection consistency windows.

Serverless platform testing: AWS SAM Local, .NET Lambda Test Tools, Cloudflare Workers Miniflare, Vercel Edge Runtime, Netlify Functions, Serverless Framework, plus cold-start + timeout budget references and a serverless integration-test builder. Covers Lambda / Workers / Edge runtimes which have specific testing patterns (cold-start budgets, timeout testing, local emulators, edge-runtime divergence) absent from generic web-server test plugins.

Time-related testing: fake-clock libraries (libfaketime, sinon-fake-timers, jest-fake-timers, freezegun, timecop, mockclock), DST + leap-second references, ISO-8601 vs RFC 3339 reference, and a timezone test matrix builder. Covers time-based bugs (DST transitions, leap seconds, timezone arithmetic, clock skew) which are high-incident-rate but specific tooling is scattered.

Auth flow testing: 6 skills (auth0-tests, keycloak-tests, mfa-flow-test-author, oauth-flow-test-author, okta-tests, session-management-test-author) and 1 agent (token-storage-security-critic). Anchored on OAuth 2.0 / RFC 7636 PKCE / RFC 9700 / OWASP ASVS V3.

Feature-flag platform testing + experimentation harness testing: SDK-specific tests for LaunchDarkly plus the OpenFeature umbrella (Unleash, Flagsmith, GrowthBook); the feature-flag test matrix reference; the experiment-sdk-testing umbrella (Statsig, Optimizely, Split.io, Amplitude Experiment, VWO); AB-test validity checklist; experiment-results interpreter (peeking + guardrail references); stale-flag detector with the removal runbook; flag-coverage-gap detector; sample-ratio-mismatch (SRM) detector. Distinct from qa-test-environment/feature-flag-test-harness (generic flag-aware test harness) and qa-shift-right/feature-flag-experiment-validator (validates production experiment results); this plugin scopes to platform-SDK testing, flag-lifecycle hygiene, and experimentation-harness integrity.

GraphQL server testing: introspection attack-surface reference, persisted-query strategy, per-framework testing (Apollo Server, GraphQL Yoga, Hasura, Mercurius, Pothos), and an N+1 query detector. Distinct from qa-contract-testing/graphql-schema-regression (contract drift detection); this plugin covers server/runtime + framework-specific patterns.

gRPC testing tooling: buf-CLI lint and breaking-build, ghz load testing, grpcurl CLI, grpc-mock servers, protobuf versioning strategy reference, gRPC streaming test patterns, and status-code mapping reference. Distinct from qa-realtime-protocols/grpc-streaming-tests (wire-level streaming semantics) and qa-contract-testing/protobuf-compat-checking (schema-level breaking detection); this plugin scopes to tooling, load, linting, and framework-level testing.

Notifications + messaging testing across email/SMS/push/webhooks: 7 skills (email-flow-test-author, in-app-notification-test-author, mailhog-testing, mailpit-testing, push-notification-test-author, sms-test-author, webhook-delivery-tester) and 1 agent (notification-delivery-critic).

Payment platform sandbox testing: Stripe test cards + webhooks, Adyen test mode, PayPal sandbox, Braintree test cards; 3DS test flow + PCI DSS scope + payment flow states references; refund + chargeback + webhook-replay builders. Distinct from qa-compliance/pci-dss-control-test-author (compliance / scope verification); this plugin is platform-specific sandbox testing + payment flow state matrices.

Real-time protocol testing: 7 skills (grpc-streaming-tests, mqtt-tests, server-sent-events-tests, sse-load-tests, stomp-amqp-tests, webhook-replay-tests, websocket-tests) and 1 agent (realtime-protocol-reviewer). Anchored on RFC 6455, WHATWG SSE, gRPC streaming, MQTT v5, and the Standard Webhooks signature scheme.

AI-assisted test generation + curation: 3 skills (ai-spec-coverage-mapper, ai-test-generator, model-based-test-graph-author) and 3 agents (ai-test-curator, ai-test-shallow-coverage-critic, mbt-suite-builder).

LLM and prompt evaluation: 7 skills (deepeval-evaluation, giskard-llm, langfuse-tracing, llm-regression-suite-author, openai-evals, promptfoo-evaluation, ragas-evaluation) and 2 agents (llm-red-team-planner, prompt-eval-reviewer). Covers the mainstream OSS LLM-eval ecosystem: Promptfoo + OpenAI Evals + DeepEval + Ragas for functional eval, Giskard for adversarial scan, Langfuse for production observability.

ML model testing: 7 skills (giskard-tests, deepchecks-tests, evidently-monitoring, fairlearn-fairness, model-performance-regression-gate, model-risk-evidence-matrix, notebook-ci-pipeline-author). Covers tabular + NLP + vision validation, drift monitoring with alert triage, group fairness with a risk-tiered promotion gate, per-prediction explainability, and the Jupyter notebook CI pipeline (papermill + nbval + testbook + nbstripout).

Search relevance testing: 6 skills (elasticsearch-relevance-tests, hybrid-search-eval-author, judgment-list-author, opensearch-relevance-tests, solr-relevance-tests, vector-search-recall-tests) and 1 agent (relevance-regression-reviewer). IR-metrics-driven NDCG / MRR / Recall@k regression detection.

CI/CD test workflow patterns: 4 skills (github-actions-test-jobs, gitlab-ci-test-jobs, jenkinsfile-test-stages, ci-test-job-conventions - the latter carries the CircleCI patterns in references/) and 1 agent (ci-pipeline-health-critic).

CLI + TUI testing tools: 4 skills (bats-testing, cli-output-conventions, pester-cli-testing, tui-snapshot-tester).

Production code quality: 5 skills (sonarqube-maintainability-gate, codeclimate-config, lizard-complexity, madge-deps, knip-dead-code) and 1 agent (code-quality-critic). Production-only scope; test-code hygiene is owned by qa-test-review.

Manual scripted + exploratory testing: 14 skills (bug-bash-facilitator, crusspic-stmpl-heuristic, decision-table-test-design, exploratory-tours-reference, fcc-cuts-vids-heuristic, hiccupps-f-heuristic, manual-test-debrief, manual-test-script-author, manual-testing-getting-started, sbtm-reference, sfdpot-heuristic, state-transition-test-design, test-execution-checklist, uat-script-author) and 3 agents (charter-coach, session-debrief-coach, test-script-quality-critic). Covers SBTM, Whittaker's seven tours, Bach + Bolton's heuristic catalogues (HICCUPPS-F oracles, SFDPOT variation, FCC CUTS VIDS modelling, CRUSSPIC STMPL quality criteria), UAT, bug bashes, and PROOF debriefs.